Set up and troubleshoot the standards that prove your mail is really yours — SPF, DKIM, DMARC, BIMI, MTA-STS, ARC, TLS-RPT, reverse DNS and MX records. Beginner and advanced guides, troubleshooting walkthroughs, and best practices that meet the latest Google, Yahoo and Microsoft sender requirements.
This ToolTrusted study breaks down DMARC adoption by TLD — measured from live DNS across the top 10,000 domains in the Majestic Million in June 2026. Headline averages hide enormous variation: depending on the top-level domain, the share of sites that actually enforce DMARC ranges from 11.0% to 79.0%. Looking at DMARC adoption by TLD … Read more
Choosing the best DMARC software is really about choosing how much you want a tool to do for you: parse the raw XML reports your domain receives, identify which services are sending as you, and guide you safely from monitoring to full enforcement. The best DMARC software turns a flood of unreadable aggregate reports into … Read more
How to enable DNSSEC for email (quick version): (1) at your DNS host (Cloudflare, Route 53, your registrar’s panel) turn on zone signing — it generates the keys and gives you DS values; (2) publish the DNSSEC DS record at your registrar to complete the chain from the parent zone; (3) verify with dig DS yourdomain.com … Read more
Email authentication statistics 2026 (the headline numbers): across the top 10,000 domains, measured from live DNS in June 2026 — 84.5% publish SPF, 76.6% publish DMARC, but only 54.0% actually enforce DMARC (quarantine or reject). MTA-STS sits at 3.6%, TLS-RPT at 4.5%, and BIMI at 9.4%. The single biggest story is the DMARC enforcement gap: … Read more
BIMI logo not showing in Gmail? The usual cause is that your DMARC policy isn’t at enforcement (p=quarantine or p=reject at pct=100) — without it Gmail never even evaluates BIMI. The second cause is the certificate: Gmail ignores self-asserted logos, so you need a BIMI VMC certificate (for the blue checkmark) or a CMC. After … Read more
Direct fix — why forwarded email fails DMARC: when a message is forwarded or sent through a mailing list, the intermediary rewrites the body and relays it from its own IP, which breaks DKIM and SPF — so DMARC fails even though the mail is genuine. The fix is ARC (Authenticated Received Chain): the forwarder … Read more
How to set up a TLS-RPT record (quick version): (1) choose where reports go — a dedicated mailbox like tlsrpt@yourdomain.com or an HTTPS endpoint; (2) publish a TXT record at _smtp._tls.yourdomain.com reading v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.com; (3) turn it on before you flip MTA-STS to enforce, so you gain visibility first; (4) point the daily JSON at … Read more
How to set up MTA-STS policy enforcement (quick version): (1) make sure every MX host has a valid TLS certificate; (2) stand up an HTTPS host at mta-sts.yourdomain.com and serve the MTA-STS policy file at /.well-known/mta-sts.txt in mode: testing; (3) publish the _mta-sts MTA-STS record (TXT) with a unique id; (4) turn on TLS-RPT and … Read more
Direct fix — reverse DNS not set up for SMTP: your sending IP has no valid PTR record, so Gmail, Yahoo and Outlook reject the connection — often with a 550 5.7.1 PTR record error. You can’t fix this in your domain DNS: the PTR lives in the reverse zone owned by whoever owns the … Read more
An MX record is the DNS entry that tells the rest of the internet which servers accept email for your domain. Every message sent to an address at your domain is routed by its MX record, which makes it the foundation of inbound mail — get it wrong and you simply stop receiving email. This … Read more